Semtech LR1110 - Wi-Fi Passive Scanning; LR1110 Wi-Fi Scanning Principle Of Operation

LR1110
User Manual Rev.1.0
UM.LR1110.W.APP March 2020
84 of 130
Semtech
www.semtech.com
10. Wi-Fi Passive Scanning
LR1110 gives the possibility to provide a device geolocation through an energy efficient scanning and processing of
802.11b/g/n Wi-Fi signals of opportunity.
10.1 Principle Of Operation
The command WifiScan( ) allows capturing the Wi-Fi signals on the RFIO_HF pin on a given channel, for a defined 802.11
signal (802.11b/g/n). The MAC addresses of the Wi-Fi access points in range on the scanned channel are then extracted with
their corresponding RSSI, and can be read out using the command WifiReadResults( ) . The scanned MAC addresses on the
various Wi-Fi channels can then be sent via a LPWAN network to the geolocation server, which calculates the device
position.
The number of Wi-Fi passive scanning results has to be determined prior to reading out the passive scanning results. This
can be done through the command WifiGetNbResults( ).
Figure 10-1: Wi-Fi Passive Scanning Sequence
Figure 10-1shows the sequence of a Wi-Fi passive scanning on a Wi-Fi channel. Upon a WifiScan( ) command, the LR1110
opens a receive window (Preamble Search window) on the given channel, until a Wi-Fi packet is detected (T
search
). The Wi-Fi
packet is then captured and demodulated, until the Access Point MAC address is extracted. During the demodulation
phase, the RF front-end is turned off, resulting in a lower current consumption. If another MAC address is to be extracted,
another Preamble Search window is opened on the same channel, until a second Wi-Fi packet is detected, captured and
the Access Point MAC address is extracted. This sequence is repeated until NbSearchAttempt (number of Wi-Fi captures in
the given channel) or NbMaxRes (total number of MAC addresses over all the configured Wi-Fi channels) is reached.
Statistically, the time spent in preamble search mode can vary between 0us (Wi-Fi packet detected immediately after the
WifiScan( ) command is executed) to the Access Point beacon interval. The LR1110 timeout parameter allows limiting the
WZD>
^Z,
WdhZ
/Y
DK
/
dŝŵĞ
dƐĞĂƌĐŚ dĐĂƉƚƵƌĞ dĚĞŵŽĚ
/Zyt/&/ϭ
/Zyt/&/ϯ
WZD>
^Z,
WdhZ
/Y
DK
dĐĂƉƚƵƌĞ dĚĞŵŽĚ
WZD>^Z,
WdhZ
/Y
DK
dĐĂƉƚƵƌĞ dĚĞŵŽĚ
ZĞƉĞĂƚ
ƐĞƋƵĞŶĐĞEdž
tŝͲ&ŝ
ŚĂŶŶĞů
ĐƚŝǀŝƚLJ
dŝŵĞ
tŝͲ&ŝ
Wϭ
tŝͲ&ŝ
WϮ
tŝͲ&ŝ
WŶ
dƐĞĂƌĐŚϮ dƐĞĂƌĐŚŶ
/Zyt/&/Ϯ